CVE-2026-60354

Analyzed Analyzed - Analysis Complete

Oracle JDeveloper Data Visualization Tools Information Disclosure

Publication date: 2026-07-21

Last updated on: 2026-07-31

Assigner: Oracle

Description

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-31

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60354

EUVD

EUVD-2026-46768

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jdeveloper	12.2.1.4.0
oracle	jdeveloper	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JDeveloper, a tool for data visualization. It allows an unauthenticated attacker to remotely access some data within the application over HTTP. The attack is difficult to perform but could lead to unauthorized data exposure.

Detection Guidance

This vulnerability affects Oracle JDeveloper versions 12.2.1.4.0 and 14.1.2.0.0. Detection involves checking for these specific versions running on your systems. Use commands like 'rpm -qa | grep jdeveloper' on Linux or check installed programs in Windows Control Panel. Network detection may involve scanning for open HTTP ports (typically 80 or 443) where JDeveloper services might be exposed.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read certain data stored in Oracle JDeveloper without authentication. This may include sensitive information depending on what data is accessible through the tool.

Compliance Impact

This vulnerability could potentially lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR or HIPAA if such data is exposed. Organizations using Oracle JDeveloper should assess their data handling practices.

Mitigation Strategies

Apply the latest Oracle JDeveloper patches immediately from Oracle's support portal. If patching isn't possible, consider disabling the Data Visualization Tools component or restricting network access to the JDeveloper HTTP ports. Implement network segmentation to limit exposure. Monitor Oracle's security advisories for updates.

Hi! I’m here to help you understand CVE-2026-60354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70